# Error in totalvotes due to a mistake in the totalweight formula

GaugeController._changeGaugeWeight multiplies typeVotes by the gauge's vote weight instead of newSum by typeWeight, corrupting totalVotes and vote accounting.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: innertia
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.22
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.22
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:governance

**Target:** GaugeController.sol vote-weight accounting
**Root cause:** totalWeight update uses (oldSum * weight) - (oldSum * typeWeight) instead of (newSum * typeWeight) - (oldSum * typeWeight), multiplying typeVotes by the gauge's own vote count rather than the type coefficient.
**Steps:**
1. Open GaugeController.sol _changeGaugeWeight (L445-451).
2. Observe `gaugeVotes[gauge][nextTimestamp] = weight` and `oldSum = _getSum(gaugeType)`, `typeWeight = _getTypeWeight(gaugeType)`.
3. Note `totalWeight += (oldSum * weight) - (oldSum * typeWeight)` multiplies oldSum by weight.
4. Compute `newSum = oldSum + (weight - oldGaugeWeight)` and compare: correct delta is `(newSum * typeWeight) - (oldSum * typeWeight)`.
5. Call _changeGaugeWeight with a weight change and observe totalVotes[nextTimestamp] diverging from true weighted sum.
**How found:** Code reading of the totalWeight update: noticed oldSum (typeVotes) was multiplied by weight (gauge vote count) while the subtraction used typeWeight, revealing the wrong operand pairing and that newSum should be used.
**Insight:** In vote-accounting contracts, check that each term in a running-total delta pairs the aggregate (sum) with the coefficient and the per-item value with the per-item delta; mismatched operand pairing in `+= (a*b) - (a*c)` patterns signals a unit confusion bug.